Unrated severityNVD Advisory· Published Jun 21, 2011· Updated Apr 29, 2026
CVE-2011-1753
CVE-2011-1753
Description
expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected products
34cpe:2.3:a:process-one:ejabberd:*:*:*:*:*:*:*:*+ 27 more
- cpe:2.3:a:process-one:ejabberd:*:*:*:*:*:*:*:*range: <=2.1.6
- cpe:2.3:a:process-one:ejabberd:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:0.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.14:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.1_2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:3.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:process-one:ejabberd:3.0.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:process-one:exmpp:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:a:process-one:exmpp:*:*:*:*:*:*:*:*range: <=0.9.6
- cpe:2.3:a:process-one:exmpp:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:process-one:exmpp:0.9.5:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
12- www.ejabberd.im/ejabberd-2.1.7nvdPatch
- git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6nvdPatch
- secunia.com/advisories/44765nvdVendor Advisory
- secunia.com/advisories/44807nvdVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2011-June/062099.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2011-June/062145.htmlnvd
- secunia.com/advisories/45120nvd
- www.debian.org/security/2011/dsa-2248nvd
- www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/nvd
- www.securityfocus.com/bid/48072nvd
- bugzilla.redhat.com/show_bug.cginvd
- exchange.xforce.ibmcloud.com/vulnerabilities/67769nvd
News mentions
0No linked articles in our index yet.